Independent testing by CLR Labs found no successful attacks in the evaluated configuration. For qualified trust service providers, banks, and other regulated organizations, this is third-party evidence of the highest-level detection of injection attacks.
The injection attack detection capability in Innovatrics Enterprise Identity Verification has achieved High-level certification for injection attack detection (IAD) under CEN/TS 18099, the European technical specification for detecting biometric data injection attacks.
High is the top level the specification defines. It is also the level ETSI TS 119 461 specifies for injection attack detection in applicable remote identity proofing processes targeting the Extended level of identity proofing, which makes the result directly relevant to qualified trust service providers and other regulated digital identity services.
At High level, CLR Labs tested the solution against multiple sophisticated injection attack techniques, including attempts to manipulate the biometric capture process. No injection attack succeeded in the evaluated configuration.
The lab measured the opposite kind of error as well. Only 1.3% of genuine capture attempts were wrongly classified as attacks. This figure is known as the bona fide presentation classification error rate, or BPCER. It indicates how often a real person’s capture may be mistaken for fraud.
“An attacker at this level needs only one way around the camera, and the tools for trying, from virtual cameras to tampered apps, are easy to get hold of. That is why no single check decides the outcome. Signals from the device, the image and the session are weighed together on the server, where the attacker cannot reach them. The harder part is doing all of that without getting in the way of genuine users, because a system that stops attackers but turns away real people with them only moves the problem somewhere else,” said Filip Stiglic, Enterprise Architect and Injection Attack Prevention Lead at Innovatrics.
Liveness detection examines what is held up to the lens. Injection attacks skip the lens entirely. The attacker feeds prerecorded, altered, or AI-generated video straight into the verification flow, often through a virtual camera that the device treats as real hardware. A deepfake that liveness detection would catch on a screen can pass unseen when it arrives this way.
The underlying injection attack detection approach is designed to be adaptable to multiple capture modalities. The certification was achieved for face biometrics, and the same injection attack detection can also protect the capture of identity documents and other biometric modalities such as palm and fingerprints.
“Identity verification depends on the integrity of what reaches the system. If an attacker can replace the camera feed, even an accurate biometric match can be misled. We build every layer of our technology ourselves, so we are accountable for how it performs in our partners’ products. Independent testing gives them and their customers evidence that our capture controls hold against that risk, and we will keep testing as attacks change,” said Jan Lunter, Founder and CEO of Innovatrics.
The High-level certification provides concrete evidence of Enterprise Identity Verification’s resilience against injection attacks and underlines our commitment to securing remote identity verification processes for organizations worldwide.
Our passion for technology brings biometric benefits to millions of people.
